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If access is granted and a connection is opened, when the connection is later 
closed, a log entry is made recording information about that access. One important 
feature of the present Web server is that log entries identify the particular virtual host 
that was accessed. Another important feature is that log entries identify the "referrer," 
i.e., the source of any link that may have been followed to get to the Web site that was 
accessed. The owner of a Web site may advertise that site through various different 
channels. In order to determine what works and what does not, in terms of generating 
hits on a Web site, one must know how someone came to access that Web site. 

Referring to FIG. 5, conventional log entries are typically of a format similar to the 
one shown. The IP address or name 501 of the accessing machine is recorded, followed 
by the UserName 503, if any, entered during the course of the access, the date and time 
505, the connection request 507 as it was received, an error code ERC (509) specifying 
any error that may have occurred, and a count 511 of the number of bytes transferred. 
As shown in FIG. 6, the present Web server logs in addition the identity of the virtual 
host (651) and the referrer (653). Log reports may be generated from this information, 
listing, for example, the top referrers generating hits to a Web site, etc. Log reports may 
be generated on a per-host basis or may be generated for the physical machine, i.e., all 
virtual hosts together. 
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